secshad0w1 @TechRubin

Cyber Security Gujarat, India Joined February 2018

Tweets

255
Followers

15
Following

287
Likes

138

Masonhck357 @Masonhck3571

2 weeks ago

A fun NoSQL vuln that caused DOS: I sent a PUT request of {"field":"last_name","value":{"$ne":null}} which persisted and crashed the Teams/Admin UI for all users within the organization LOL #bugbounty #infosec Normal request body was: {"field":"last_name","value":"mason"}…

8 29 292 20K 236

Kyros @IamKyros69

2 weeks ago

2015: - Clash of Clans - Subway Surfers - Pokémon - Shadow fight 2 2019: - PUBG - Minecraft - Fortnite - GTA V 2025: - X - GitHub - VS Code - ChatGPT - Cursor

152 555 6K 117K 519

CaptinSHArky(Mahdi🇹🇳) @SalhiMahdi72759

3 weeks ago

Tip: When testing, try injecting a null byte (\u0000) into unexpected parameters. You never know how the backend will handle it — sometimes a small injection can completely break features like the invitation system. #BugBounty #BugBountytips #Hacking #Cybersecurity

5 38 246 12K 173

Download Image

André Baptista @0xacb

2 months ago

Have you checked out @hadriansecurity's subwiz? It's a recon tool that uses ML to predict and resolve subdomains👇

3 52 252 15K 243

Download Video

Aituglo @aituglo

2 months ago

New Hackyx Version 🚀🚀 hackyx.io - AI Search Mode - New dashboard to manage content - Automatically fetch new write-ups, bug reports and articles - RSS feed crawler - A queue system to handle jobs - Content with embeddings for better search - Filtered content to…

5 42 154 9K 123

Download Image

André Baptista @0xacb

5 months ago

This email domain confusion technique from @garethheyes is so cool! Some really weird behavior can be found between different mail agents and the right characters/symbols 🤔

3 87 604 34K 504

Download Image

Hack3rScr0lls @hackerscrolls

5 years ago

Sometimes you can control the href value in HTML tag<a>. So it's a good place for XSS payload! We've created a scheme how to use various encodings in href to bypass filters. gist.github.com/hackerscrolls/… @XssPayloads #BugBountyTip #Bypass

0 176 426 0 120

Download Image

Kévin GERVOT (Mizu) @kevin_mizu

11 months ago

I'm thrilled to finally share my research on HTML parsing and DOMPurify at @grehack 2024 📜 The research article is available here: mizu.re/post/exploring… The slides are available here: slides.com/kevin-mizu/gre… 1/3

18 180 705 76K 375

Download Image

s1r1us @S1r1u5_

11 months ago

@NahamSec Pick a niche, become an expert, find bugs maybe even 0days or reverse n-days, and write blogs. Even if you don’t hit those $100k bounties, it’ll be a stepping stone toward a $100k job. What niche? How to pick? Examples? infosec being so vast from web3 sec to web2, mobile,…

19 202 911 89K 886

encodedguy - jsmon.sh @3nc0d3dGuY

a year ago

🚀🚀Launched Reverse JS Search in jsmon.sh today!! Let's say you want to know, an IP address 10.0.0.1 is in how many JS urls? Or, a particular hostname, api path, email or a GQL query is present in which JS urls? Here's how you can do this!!

2 15 63 8K 46

Download Video

VAIDIK PANDYA @h4x0r_fr34k

2 years ago

Daily Notes : Day 86 Content Security Policy Bypasses - Part 1 1. Unsafe Inline Content-Security-Policy: script-src google.com 'unsafe-inline'; Working payload: "/><script>alert(1);</script> 2. Unsafe Eval Content-Security-Policy: script-src…

0 15 73 6K 40

Will Gates @WllGates

2 years ago

I just published my new tool DirDar; DirDar is a tool that searches for (403-Forbidden) directories to break it and get dir listing on it Link on Github: github.com/M4DM0e/DirDar credit: @M4dM0e #bugbountytips #bugs #Hackerone #BugCrowd #hackingnews

2 105 329 18K 215

Download Image

Ankita Tripathi @ankitatr_

2 years ago

People start with 3 LPA and reach 30. People start with sharing a room in an apartment to living alone in a 2bhk. People start with nominal English sentences to being fluent. People start with being camera shy to being great creators. People start with ordering food online with…

132 485 5K 318K 898

Tony @TJ_Null

2 years ago

After a few months of reviewing the latest PWK course, I have decided to refactor my list to create a new list of VM's for those who are preparing for the PWK/OSCP. Here is the link to see the new list: docs.google.com/spreadsheets/d…

13 153 463 71K 279

Download Image

Derin Eryilmaz @deryilz

2 years ago

My first blog post! It's about CVE-2023-4369, a $10,000 bug I found in ChromeOS in July. The bug used a chrome:// URL XSS to allow Chrome extensions to execute privileged code and read/edit downloaded files without user interaction. 👀 0x44.xyz/blog/cve-2023-…

9 135 525 51K 163

Jayesh Madnani @Jayesh25_

2 years ago

🔒Sharing more secrets - It's 2023, and CSRF issues are far from extinct. In fact, I've discovered and reported 100+ CSRF vulnerabilities this year, raking in five figures $$$$$!💰 🚀 My top 5 CSRF bypass techniques and their secrets to success: 1️⃣ Swap "POST" with "GET":…

18 146 578 45K 414

Ananda Dhakal @dhakal_ananda

3 years ago

Never expect anything after reporting a bug. Unmet expectations lead to frustration which might eventually lead to burnout. #bugbountytips

9 13 102 0 3

Mahmoud Abd Alkarim @Maakthon

2 years ago

DOM based XSS Recently I was able to find a DOM based XSS, This vulnerability usually arise when JavaScript takes data from an attacker-controllable source. Thread 🧵 #bugbountytips #domxss #xss

5 17 127 11K 51

Download Image

sudi @sudhanshur705

2 years ago

I along with @aszx87410 was recently able to find an interesting case of a DOM based xss in figma.com Sharing the details in this writeup as the bug is fixed now github.com/Sudistark/xss-…